What came into force with the EU’s AI Act this week – and what didn’t

On August 2, the next phase of Europe’s Artificial Intelligence Act came into force as the European Union frames this legislation as the world’s first comprehensive law on AI.

Like the General Data Protection Regulation (GDPR) before it, this new EU legislation is intended not to replace the economic bloc’s existing digital rulebook but to complement it.

Recommended Stories

• list 1 of 4After OpenAI disclosure, Anthropic says Claude also hacked outside systems
• list 2 of 4Israel’s influence industry in the US
• list 3 of 4Australia’s under-16 social media ban failing, study shows: What it means
• list 4 of 4Tech giant Palantir posts ‘otherworldly’ growth despite criticism over Gaza

While GDPR governs how organisations collect and use personal data, the AI Act regulates how AI systems are developed and deployed.

GDPR has gone on to shape privacy practices well beyond Europe, becoming the benchmark against which many multinational organisations design their compliance programmes. The question now is whether the AI Act will prove just as influential for AI governance.

What came into force this week?

Article 50 of the AI Act now begins to apply, adding a transparency layer to the EU’s broader AI rulebook. Chatbots and other AI systems that interact directly with people must disclose that users are dealing with AI unless the context makes that obvious.

Providers of AI systems that generate or manipulate images, audio, video, or text must ensure that synthetic content is identifiable through machine-readable marking where required by the Act.

Systems used to recognise emotions or categorise people using biometric data must inform individuals that such processing is taking place. Certain law enforcement activities are exempt from some of these transparency obligations. The key point is that these provisions require disclosure, not a general ban on the technology, and breaches can attract administrative fines of up to 15 million euros ($17.3m) or 3 percent of global annual turnover, whichever is higher.

For companies, the immediate impact is mostly operational rather than transformational.

The rules do not require businesses to abandon AI systems or obtain prior approval before deploying them. Instead, they add a layer of compliance.

For many organisations, the practical challenge will be identifying where AI is already embedded in products, customer interactions and internal processes – including tools bought from third-party vendors – and ensuring those systems meet the new transparency requirements.

What has been delayed, and why?

The AI Act’s most far-reaching operational requirements – the “high-risk” obligations for AI systems used in areas such as biometrics, employment, education, essential services, and migration, asylum and border management – were due to apply from August 2 alongside the transparency rules.

But in May, EU lawmakers agreed to postpone those obligations until December 2, 2027 as part of the Digital Omnibus package. The result is that, while these systems remain subject to existing laws such as GDPR and sector-specific regulation, they will not yet have to comply with the AI Act’s dedicated high-risk governance, risk management and oversight requirements.

The European Commission presents the postponement as an implementation adjustment rather than a retreat from AI regulation.

At the time, Executive Vice President Henna Virkkunen said the aim was to “make it easier to innovate without lowering the bar on safety”, arguing that companies and regulators needed clearer guidance, technical standards and support tools before the most demanding obligations took effect.

The commission also linked the change to its wider competitiveness agenda, invoking former European Central Bank President and Italian Prime Minister Mario Draghi’s 2024 report on European competitiveness, which argued that the EU regulatory burden was holding back growth across the economy, though not AI specifically.

European Parliament negotiators backed the compromise by a vote on the grounds that the technical standards underpinning compliance for high-risk AI systems were not ready in time.

Digital rights groups have challenged that explanation, arguing that reopening a recently adopted law risks weakening protections and rewards industry lobbying. They warn that the delay could establish a precedent for further postponements in Europe’s digital rulebook.

Who does the delay most affect, and what do critics say it misses?

Annex III of the EU AI Act already classifies certain AI systems used in migration, asylum and border management as “high risk”, reflecting the bloc’s own recognition that these technologies can affect people in particularly vulnerable situations.

The category covers tools used for purposes including assessing risks, assisting decisions on asylum, visa and residence applications, and detecting, recognising or identifying individuals at borders.

Under the full AI Act regime, these systems would face additional safeguards, including requirements around risk management, documentation, data governance, traceability and human oversight. But those obligations will not apply until the delayed deadline.

Critics argue this leaves some of the people most exposed to automated decision-making without the AI Act’s strongest protections for an additional 16 months. Existing safeguards, including GDPR and national law, remain in place, but campaigners say they do not address every risk posed by opaque or potentially discriminatory AI systems.

“The AI Act already undermines the EU Charter’s non-discrimination clauses,” says Stefi Richani, advocacy lead at the Equinox Initiative for Racial Justice, which works with the EU-wide ProtectNotSurveil coalition. She argues that delaying what she describes as the Act’s already limited migration safeguards “will increase surveillance and discrimination, and even result in asylum claims being unlawfully rejected based on personal characteristics or racialised suspicion”.

For Richani, the deeper problem predates the delay. “No amount of safeguarding or guidelines can circumvent structural biases against migrants,” she says, arguing that predictive and automated systems in this context should be banned rather than regulated, with investment directed instead towards safe routes and social protection.

Does this reach beyond the EU?

On transparency, companies that build AI systems to meet the EU’s disclosure and labelling rules tend to roll out the same standards worldwide rather than run separate compliant and noncompliant versions.

This is the same “Brussels effect” that turned GDPR into a global privacy benchmark. But on the highest-stakes uses, the EU’s influence runs in the opposite direction.

The bloc funds migration and border-surveillance technology deployed in third countries outside its own borders – used, for instance, at transit points along migration routes into Europe – and those deployments sit outside the AI Act’s reach altogether, regardless of what its high-risk rules eventually require in the EU. The law’s disclosure requirements may end up applied globally, but its strongest protections stop at the EU’s own border.

What next?

The AI Act is entering force in stages.

Prohibited AI practices and rules on AI literacy began applying in February 2025. Obligations for general-purpose AI models followed in August 2025. Transparency requirements took effect this week. And the delayed high-risk obligations are expected to apply from December 2027.

The phased rollout reflects the complexity of regulating a fast-moving technology sector, and the controversy over whether implementation should move carefully or whether delays risk weakening protections before they are fully tested. Critics say each delay disproportionately spares industry from scrutiny while leaving the systems used against migrants and jobseekers unregulated for longer.